A memory corruption flaw exists in Adobe Flash Player. A specific ActionScript3 object's construction fails to sanitize user-supplied input when the object is applied to a bitmap copy, resulting in memory corruption. With a specially crafted file or page, a context-dependent attacker can execute arbitrary code.

Upgrade to version 10.2.152.26 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1025055
• OVAL ID: 13205
• CVE ID: 2011-0578 (see also: NVD)
• Secunia Advisory ID: 43021 43267 43292 43340 43351 43650 43747 46322
• Bugtraq ID: 46195
• ISS X-Force ID: 65240
• VUPEN Advisory: ADV-2011-0348 ADV-2011-0383 ADV-2011-0402 ADV-2011-0646
• Other Advisory URL: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash2
  http://www.zerodayinitiative.com/advisories/ZDI-11-081
  http://www.zerodayinitiative.com/advisories/ZDI-11-081/
• Vendor Specific Advisory URL: http://googlechromereleases.blogspot.com/2011/02/stable-channel-update_08.html
  http://www.adobe.com/support/security/bulletins/apsb11-02.html
• Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00003.html
  http://seclists.org/fulldisclosure/2011/Oct/593
• Vendor Specific News/Changelog Entry: http://www.gentoo.org/security/en/glsa/glsa-201110-11.xml
  https://hermes.opensuse.org/messages/7533006
• RedHat RHSA: RHSA-2011:0206 RHSA-2011:0259 RHSA-2011:0368

• Anonymous - Zero Day Initiative (ZDI)